It's a sandbox issue 100%. I think you're correct about the app group entitlement causing the issue here - thanks for the lead. The Info.plist needs to include the com.apple.security.application-groups key for both apps from what I understand. Electron builder does have a property for adding keys to that plist (https://www.electron.build/mas#extendinfo) so that's my next adventure.

[quote='841755022, DTS Engineer, /thread/786366?answerId=841755022#841755022'] com.apple.security.application-groups is a code signing entitlement, not an Info.plist key [/quote] I was confused when I read something suggesting it needed to be included in each Info.plist. My entitlements.mas.plist already includes this key with the proper value and format. That should be the extent of what is needed for group permissions from what I can find. After more research, I'm suspecting the permission issue might be a broader issue with Electron itself. There were permission errors when initially installing that package and I'm wondering if something wasn't resolved there. I also discovered the TestFlight version was somehow launching from the project's root and not the sandboxed Applications folder at one point ('fixed' by running under another user account). Planning to try a full reinstall.

Just an update: I realized the "expected 4" in the error was expecting 'Read' permissions, but none were assigned (observed 0): org.chromium.crashpad.child_port_handshake.9915.63117.BUEXLMXFWPLCEONM: Permission denied (1100) [0601/152740.226091:ERROR:file_io.cc(94)] ReadExactly: expected 4, observed 0 I did a fresh install of the entire system and all packages (not using sudo). I went through all project folders using $ find . ! -perm -g+r in the terminal to find any contents missing read permissions. Changing these permissions using chmod before building (and during building with a hook) gave the same error. However, I did find a solution. I rebuilt the functionality of the app using npm packages bluebird and puppeteer-in-electron. bluebird replaces puppeteer-cluster for concurrency control and puppeteer-in-electron opens Chromium through Electron, so it no longer needs to be bundled separately, and everything now works without any permission errors.